Need assistance with Windows 2008 R2 server BSOD - ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)

Question

Need assistance with Windows 2008 R2 server BSOD - ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
I have a Windows 2008 R2 server which is experiencing random BSOD during the night. This is occurring maybe once or twice a week. I have gathered two Memory crash files. This server is running Citrix XenApp 6.5 but nothing else is reporting an issue except
for the memory dump. I’m looking for assistance in reading crash file and finding the cause.
I’ve spent over a week going through articles trying to learn and trouble shoot the BSOD but no closer to understanding the WinDbg 6.3.9600 report.
This is a production server and I have verified that Windows Updates has updated the server with latest releases. I’m hoping that the crash file will show something before I have to run the Driver Verifier.
The crash zip file is located -
https://onedrive.live.com/redir?resid=9644A4E0A26873B1!2359&authkey=!AMS4Svuk-SS3-JA&ithint=file%2czip
*                        Bugcheck Analysis                                   
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory.  The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff880009eff38, Virtual address for the attempted execute.
Arg2: 8000000002cfe963, PTE contents.
Arg3: fffff8800da2eea0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0xFC
PROCESS_NAME:  powershell.exe
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
TRAP_FRAME:  fffff8800da2eea0 -- (.trap 0xfffff8800da2eea0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80070f3648 rbx=0000000000000000 rcx=fffffa80070f3648
rdx=fffff8800da2fbf8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001680b80 rsp=fffff8800da2f030 rbp=fffff8800da2fbd0
 r8=fffff8a01804c680  r9=fffff8800da2fc68 r10=fffffffffffffffd
r11=fffff8800da2fa90 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl nz na pe nc
nt!KiPageFault:
fffff800`01680b80 55              push    rbp
Resetting default scope
STACK_COMMAND:  kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+44dfc
fffff800`017008b8 cc              int     3
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+44dfc
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb
IMAGE_VERSION:  6.1.7601.18409
FAILURE_BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc
BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_0xfc_nt!_??_::fnodobfm::_string_+44dfc
FAILURE_ID_HASH:  {aa632d36-b0f7-67cf-89e2-1cec389c0a11}
Followup: MachineOwner

Answer 1

Hi Kaysel_GTG,
Just addition. Regarding to Bug Check 0xFC, please refer to following article and check if can help you.
Bug Check 0xFC: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
By the way, since it is not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer
Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
if any update, please feel free to let us know.
Hope this helps.
Best regards,
Justin Gu